the average clustering coefficient \(\langle C \rangle \)  of real networks is much higher than expected for a random network of similar \(N\)  and \(L\)  (i.e., \(E\) ).
To construct a random network according to Watts-Strogats Model [1]}:

Start from a ring of \(N\)  nodes, whereas each node is connected to its immediate previous and next neighbours; hence, each node has \(\langle C \rangle = 3/4\) , initially.

With probability \(p\in [0,1]\)  each link is rewired to a randomly chosen node
\({\left\lbrace \begin{array}{ll} if p\simeq 0 , & regular lattice \\if 0<p<1 , & Small-World property\\if p=1 , & Random Network Model (all links rewired).\end{array}\right.}\) 

The Watts-Strogatz model interpolates between a regular lattice, which has high clustering (but lacks the Small-World phenomenon), and a random network, which has low clustering (but displays the Small-World property).
Moreover, high nodes degrees are absent from Watts-Strogatz model.
Barabási-Albert Model
This model was theorized by Albert-László Barabási (1967) and Réka Albert (1972) [2]}.
It simulates a Scale-Free Network rather than a Random one, by introducing two new concepts to the model: network growth and the preferential attachment.
The first concept assumes that real networks continuously increase over time, so new nodes must be considered.
The second point argues that random connections defined by a fixed probability do not reflect the behaviour of real networks; in fact, in real scenarios, nodes tend to link to the more connected nodes.

The Preferential Attachment is the probability \(\Pi (k)\)  that a link of the new node \(n_j\)  connects to node \(n_i\)  depends on the degree \(k_i\)  through the formula
\(\Pi (k_i) = \frac{k_i}{\sum _j k_j}.\) 
To construct an artificial network with the Barabási-Albert model, the steps are:

Start with a set of \(N_0\)  nodes, the links between which are chosen arbitrarily, as long as each node has at least one link.

Growth – At each timestep a new node \(n_j\)  with \(l\)  links (with \(l\le l_0\) ) that connects the new node to nodes already in the network is added.

The connections between the new node with the older nodes are defined by the Preferential Attachment probability.

Social Network Analysis in Criminal Networks
In this section we provide an overview of state-of-the-art of Social Network Analysis applied to Criminal Networks. We also consider the most relevant studies concerning specifically the Sicilian Mafia criminal topologies.
Criminal Networks Analysis
Through SNA, LEAs are able to analyze criminal networks and investigate the relations among criminals. For this reason, nowadays there is a growing interest in the application of Graph and Network Science onto criminal networks. For instance, SNA has been used in [3]} to build crime prevention systems. However, due to the lack of data availability on those kind of networks, there are difficulties in finding relevant quantitative studies. Such examples are those conducted by Szymanski [4]} and Berlusconi [5]}, on the problem of community detection and link prediction.

Sicilian Mafia networks
Sicilian Mafia has a particular structure that differs from common criminal networks (such as the terrorist nets), whereby it is a common practice for criminals to come together to achieve a common goal and then fall apart. By contrast, in Sicilian Mafia this behaviour does not occur. Indeed, the affiliates are bound by blind loyalty and they still pursue further goals even after achieving a previous one. Moreover, Families last for several generations. They also tend to diversify their objectives: from controlling entire economic sectors (e.g., by giving “protection” to small traders and taking control of larger factories), to influencing countries political life (e.g., by interfering in the results of electoral competitions). Sicilian Mafia originated in Sicily, and has now spread worldwide [6]}, [7]}, [8]}.
The blind loyalty of affiliates makes it even more difficult to obtain reliable information about those criminal networks topologies: important information about such criminal network is likely to be missing or hidden, due to the covert and stealthy nature of criminal actions [9]}, [10]}, [11]}, [12]}.

Case study: The Sicilian Mafia
This section describes firstly the real criminal datasets we used for our tests, followed by a brief summary on the strategies conducted jointly with the results obtained so far as an example on Network Science strength, and how it can be used to significantly help LEAs. In particular, the experiments relate to: [label=()]
weight distribution,

shortest path length, and

degree distribution.
Dataset Description
The case study example relates to two real-world datasets we built from juridical actsDatsets and source code are available at https://github.com/lcucav/criminal-nets [13]}:
[label=()]
the Meetings dataset represents the physical meetings among criminals obtained through LEA evensdropping;

the Phone Calls dataset refers to phone calls between individuals obtained through LEA interceptions.
This particular investigation was a prominent operation conducted during the first decade of the 2000s and focused on two Mafia clans known as the “Mistretta” family, and the “Batanesi”clan [14]}, [15]}, [13]}.
Both datasets led to undirected and weighted graphs; thus, edge weights \(w\)  are available and represent the number of times any given pair had a meeting in the Meetings dataset, and the number of times two individuals called each other in Phone Calls dataset. In SNA, those coefficients are also known as the strength of the tie binding two individuals [15]}. In Fig. REF , the graphs obtained as well as the description of what each element represents (i.e., nodes, colours, edges weight, nodes and edges size, etc.) is shown. The main characteristics of the datasets are summarized in Table REF .
<FIGURE><TABLE>Weight Distribution Analysis
Fig. REF  shows the weight distribution of the Meetings and the Phone Calls networks. As already mentioned, the weights represent the amount of meetings and phone calls exchanged between pairs of individuals in the networks, respectively.
It is noteworthy that in both these networks there are just a few high-weight edges i.e.; nodes incident on those links exhibit an high number of interaction within the network. In [15]}, we motivated this behaviour as a necessity from affiliates to focus their efforts in trying to reduce the risk of being intercepted by external people (i.e., LEA, and other people outside the clan). In the Meetings network, this trend is even more accentuated; moreover, the maximum interactions weight (i.e., \(w = 10\) ) is greater than its counterpart in the Phone Calls network (i.e., \(w = 8\) ).
Our explanation is that mobsters prefer to communicate by face-to-face meetings, rather than calling each other, to reduce interception risks. Furthermore, bosses often have to participate to public events to pursue their power inside a clan, including: funerals of other affiliates, and other solemn religious demonstrations (masses, processions, etc.). It is a well known practice that, during those kinds of events, bosses pass messages to their closest subordinate affiliates.
<FIGURE>
Shortest Path Length Analysis
The shortest path length distribution in Fig. REF  is closely related to dynamic properties such as velocity of messages spreading process within the network. Generally speaking, the criminal organizations structure aims to to optimize the interaction frequency among members, while reducing as much as possible the interception risks. Thus, trusted members may be discovered by following short interactions paths; indeed, those affiliates may also be acting as a bridge (See Sect. REF “Connectedness”) to connect distant groups in the network.
In [15]} we noticed that both the weighted and the unweighted shortest path length analyses show a higher interaction frequency among affiliates throughout a “balanced” number of intermediates. This means that they do not like to spread their encrypted messages with a too low (resp., high) number of intermediates. This is to avoid, from one side, to overexpose their bosses to police investigations. From the other side, the longer the sequence of intermediates, the higher the chances to be intercepted by people outside the Family.
Even through this analysis, as it was for the weights distribution, it emerged that the clan tries to minimize the risk of interceptions, especially to avoid exposing those mobsters who are hierarchically in a higher rank.
<FIGURE>
Degree Distribution Analysis
The Degree Distribution Analysis has been conducted in order to discover an appropriate artificial network that would virtually mirror the real-world criminal graphs topology under scrutiny. We previously analysed the weight distribution, but due to lack of libraries available for weighted graphs analysis https://networkx.github.io/documentation/networkx-1.9/reference/generators.html, we opted for a preliminary analysis on nodes degree distribution. To this end, in Fig. REF  we compared our real criminal networks against five artificial models: [label=()]
the Random Network by Gilbert (G-ER),

Watts-Strogatz (WS),

its variant accordingly with Newmann [20]} (N-WS), and

two different configurations of the Barabási-Albert (BA) model in terms of links added at each step; BA2 with \(m=2\) , and BA3 with \(m=3\) .
 Table REF  and Table REF  summarize the number of edges and average degree obtained with the configurations above described in Phone Calls and Meetings graphs, respectively.
Note that all the results herein shown represent the average results obtained after 100 runs per each synthetic network.
We initially compared the real networks with the Erdős-Rényi (ER) topology, but this model did not allow to customize the number of links. Then, we opted for the Gilbert one, whereby both number of nodes \(n\)  and links \(m\)  are defined a priori.
In the WS model, we set \(n\) , \(k=\frac{2m}{n}\)  (that represents the number of nearest neighbors links per node), and the rewiring probability \(p=0.5\) , with \(p\in [0,1]\) . As previously asserted in Sect. REF , if \(p=1\) , we turn into a Random Network.
The main difference between WS and N-WS models is that in WS, number \(p\)  is the probability of rewiring each edge; whereas in N-WS, \(p=0.25\)  is the probability of adding a new edge for each edge. Indeed, if \(p=1\) , then number of edges is doubled.
<FIGURE><TABLE><TABLE>The actual graphs degree distributions act very differently from one another. In particular, the fluctuations in Meetings are justified by the fact that face-to-face encounters have been observed not only between couple of suspects, but also among groups of more than two people at the same time. On the other hand, phone calls have only been considered between individual suspects.
The analysis suggests that through degree distribution it was not possible to identify an appropriate artificial network that best fits the network characteristics of the two real-world datasets considered. This is mainly due to the size of the networks. In fact, artificial networks seem to work better with lager sizes; thus, are quite unstable in the first step of their creation.
For example, the emergence of hubs in BA models cannot be highlighted because of the small size of the overall network obtained.
Conclusions
This chapter aims to showcase the applicability of Graph Theory in Criminology, during a time when the use of SNA by LEAs is growing substantially. The case study herein reported as an example, explores different approaches on criminal networks analysis by means of network science tools.
In our study we have first created a graph from data extracted from juridical acts; then, we started a twofold preliminary investigation: a weight distribution analysis, and in parallel, a shortest path length analysis. These have been conduced to identify the extent by which weighted graphs are useful in those small networks.
Thus, we conducted a comparative degree distribution analysis between our real-world networks and some models generated by popular artificial networks. The aim was to identify the appropriate synthetic network which could simulate criminal networks artificially, but in an effective manner. The strength of this idea is that we may also be able to understand the patterns followed by criminals to create their internal interconnections among affiliates. Our study has found that the network size is a limitation. Indeed, there are significant fluctuations and through degree distribution comparative analysis it was not possible to find an appropriate artificial network that accurately mirrors the two real criminal networks used in our tests.
To overcome this issue, in future studies we will investigate adjacency matrix structures for both real and synthetic networks to get insights into network topologies.
